How AI-leading Security Teams Are Building the Agentic SOC
How AI-leading Security Teams Are Building the Agentic SOC
2026-07-14 归档
今日共收录 1138 条安全情报，包含 379 个 CVE，396 篇安全通告，以及 80 篇研究论文。
← 返回归档列表CrowdStrike Uncovers New Prompt Injection TechniquesJul 07, 2026
CrowdStrike Uncovers New Prompt Injection TechniquesJul 07, 2026
Falcon Secure Access Sets the Standard for Zero Trust Browser Security
Falcon Secure Access Sets the Standard for Zero Trust Browser Security
Why AI Governance Without Guardrails Is TheaterJul 09, 2026
Why AI Governance Without Guardrails Is TheaterJul 09, 2026
OpenAI temporarily relaxes GPT-5.6 Sol usage limits
OpenAI is temporarily relaxing GPT-5.6 Sol usage after demand for the company's most powerful model surged over the past
Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time
Anthropic has just extended access to Claude Fable 5 for paid subscribers until July 19, giving you another week to keep
Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID
Microsoft Entra ID makes passkeys the default sign-in experience and introduces a new model for SMS and voice authentica
Japan's largest taxi operator shuts systems after cyberattack
Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the co
Hackers backdoor Jscrambler npm package with infostealer malware
The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm p
New CrashStealer malware poses as Apple crash reporting tool
A new macOS information-stealing malware called CrashStealer pretends to be Apple's crash-reporting tool to steal creden
CISA warns of actively exploited RCE flaws in Joomla extensions
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilitie
Lidl discloses online shop breach after service provider hack
German discount supermarket chain Lidl notified customers in Germany, Belgium, and the Netherlands that attackers stole
UK charges suspects linked to Russian Coms call spoofing platform
UK authorities charged five people following a National Crime Agency (NCA) investigation into Russian Coms, a major call
EU sanctions Russian GRU military hackers over cyberattacks
The European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and entities and accused Russ
Cross-Layer Misalignment Detection in Agent Skills: A Progressive Loading-Aware Contrastive Learning Approach
随着大语言模型（LLM）Agent的广泛应用，通过Agent技能（Agent Skills）扩展功能已成为常见做法。Agent技能是可重用的构件，包含自然语言元数据、过程指令和执行时资源，供运行时使用。在开源技能市场不断扩大的背景下，用户和
Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents
该论文关注LLM代理在执行过程中产生的持久效果（durable effects）的授权问题。作者发现，代理可能利用早期有效的授权证据（如DOM快照、批准时间段、版本见证、分支令牌或工作节点结果）来提交持久效果，而这些证据在提交时可能已失效。
Graph-Based Structural Evaluation of LLM-Translated Adversary Emulation Procedures
该论文提出一种基于图的对抗仿真程序结构评估方法（GBSE），用于评估大语言模型（LLM）跨操作系统翻译多步攻击程序时的保真度。核心问题在于：LLM翻译可能仅重命名工具而保留原平台逻辑，导致防御评估缺乏目标平台覆盖率，且二元评分因仅度量计数特
AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation
本文提出AMT-X（自适应多轮利用）框架，用于对大型语言模型（LLM）进行多轮红队测试。现有安全评估多依赖单轮攻击数据集和单一评分器，低估了自适应多轮对手的风险，且报告单一成功率无法区分部分可操作输出与包含完整操作细节的输出。AMT-X将攻
Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability
该论文针对模型上下文协议（MCP）的安全评估现状进行了系统研究。MCP已成为基于LLM的智能体与外部工具及服务交互的标准接口，其安全性至关重要。然而，现有安全扫描器对MCP服务器的风险评估可靠性存疑。作者构建了MCPZoo——目前最大的MC
Can Watermarking Techniques Help Prevent LLM Model Stealing?
该论文研究如何使用水印技术防御针对大型语言模型（LLM）的模型窃取攻击。近年来，模型窃取攻击允许攻击者从黑盒商业语言模型中提取精确信息，例如模型参数或隐藏层维度。作者针对Carlini等人（2024）提出的攻击及其扩展——提取生产语言模型隐